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Abstract.  Mobile  ad  hoc  and  sensor  networks  often  contain  a  mixture  of  nodes,  some 
of  which  may  be  selfish  and  non-cooperative  in  providing  network  services  such  as 
forwarding  packets  in  order  to  conserve  energy.  Existing  trust  management  protocols 
for  mobile  ad  hoc  networks  (MANETs)  advocate  isolating  selfish  nodes  as  soon  as 
they  are  detected.  Further,  altruistic  behaviors  are  encouraged  with  incentive 
mechanisms.  In  this  paper,  we  propose  and  analyze  a  trust  management  protocol 
based  on  the  demand  and  pricing  theory  for  managing  group  communication  systems 
where  system  survivability  is  highly  critical  to  mission  execution.  Rather  than  always 
encouraging  altruistic  behaviors,  we  consider  the  tradeoff  between  a  node’s 
individual  welfare  (e.g.,  saving  energy  for  survivability)  versus  global  welfare  (e.g., 
providing  service  availability)  and  identify  the  best  design  condition  so  that  the 
system  lifetime  is  maximized  while  the  mission  requirements  are  satisfied. 

Keywords:  Trust,  trust  metrics,  trust  management,  mobile  ad  hoc  networks, 
demand  and  pricing  theory,  altruism,  selfishness. 


1  Introduction 

Most  existing  trust  management  protocols  in  mobile  ad  hoc  networks  (MANETs) 
encourage  cooperative  behaviors  while  discouraging  selfish  behaviors  of  participating 
nodes,  so  as  to  achieve  a  prescribed  system  goal  such  as  high  service  availability.  A 
common  approach  is  to  isolate  selfish  nodes  as  soon  as  they  are  detected  and  to  reward 
altruistic  nodes  with  incentives  to  encourage  cooperation.  However,  in  MANET 
environments  where  resources  (e.g.,  bandwidth,  memory,  computational  power,  and 
energy)  are  severely  constrained,  only  encouraging  altruistic  behaviors  may  adversely 
shorten  the  system  lifetime.  This  is  because  altruistic  nodes  may  die  quickly  due  to  energy 
depletion,  thereby  possibly  resulting  in  loss  of  connectivity  and  system  services. 

Thomas  et  al.  [18]  studied  system  performance  in  such  a  scenario,  and  noted  that  there 
is  a  tradeoff  between  energy  saved  by  selfish  nodes  and  service  availability  provided  by 
cooperative  nodes.  However,  no  analysis  of  the  tradeoff  was  given.  Papadimitriou  [13] 
coined  the  term  the  price  of  anarchy  to  describe  the  two  conflicting  goals  of  individual 
welfare  versus  global  welfare,  i.e.,  the  local  goal  of  a  selfish  node  to  save  its  energy  versus 
the  global  goal  of  an  altruistic  node  to  provide  high  service  availability.  Similar  issues 


arise  in  routing  in  MANETs  (e.g.,  a  local  goal  through  selfish  routing  versus  a  global  goal 
for  service  availability)  [15].  The  price  of  anarchy  was  defined  as  the  performance 
difference  between  a  system  run  by  an  all-knowing  benign  dictator  who  can  make  the  right 
decisions  to  optimize  system  performance,  versus  a  system  run  by  a  selfish  anarchy.  We 
postulate  that  there  should  be  a  tradeoff  between  system  survivability  and  service 
availability  in  terms  of  these  two  conflicting  goals.  As  Thomas  et  al.  [18]  indicated,  each 
node  can  make  a  decision  for  its  own  benefit  as  well  as  for  global  interest  by  considering 
the  dynamics  of  the  network  as  well  as  its  own  conditions  (e.g.,  energy  level). 

We  propose  and  analyze  a  trust  management  protocol  that  trades  off  node  altruism  for 
system  survivability  for  mission-driven  group  communication  system  (GCS)  in  MANETs 
based  on  the  concept  of  cognitive  networks.  In  a  cognitive  network,  each  node  has 
intelligence  to  adapt  to  dynamically  changing  MANET  environments  through  a  learning 
process,  by  adjusting  its  altruistic  and  selfish  behaviors  in  response  to  network  dynamics. 
We  seek  to  identify  the  optimal  design  settings  that  maximize  system  lifetime  while 
satisfying  performance  requirements  such  as  service  availability. 

Our  trust  management  protocol  adopts  demand  and  pricing  (DP)  theory  originally 
derived  from  economics  [4];  under  DP  a  node  decides  whether  it  should  behave  selfishly 
or  altruistically  based  on  the  balance  between  individual  welfare  (i.e.,  saving  energy)  and 
global  welfare  (i.e.,  providing  services).  A  node’s  decision  may  depend  on  its  own  energy 
level,  1-hop  neighbors’  selfishness  levels  (i.e.,  to  judge  whether  the  system  still  has 
sufficient  resources  such  as  an  adequate  number  of  cooperative  neighboring  nodes),  and 
the  degree  of  node  importance  to  mission  success  (e.g.,  to  judge  whether  a  node’s  selfish 
behavior  would  have  a  significant  detrimental  impact  on  the  mission  success  rate).  Social 
scientists  have  addressed  the  tradeoff  between  local/individual  utility  and  global/collective 
interest  in  the  area  of  collaboration  theories  using  the  concept  of  trust  in  groups,  teams, 
and  organizations  [7].  However,  no  prior  work  addresses  this  tradeoff  in  the  context  of 
trust  management  in  MANETs.  A  number  of  prior  studies  have  also  taken  economic 
perspectives  in  modeling  communication  networks  [2,  9,  10,  14,  22].  Unlike  these  prior 
studies,  our  work  concerns  trust  management  and  we  specifically  adopt  DP  theory. 

Many  routing  protocols  for  MANETs  have  been  developed  to  isolate  selfish  nodes 
and  to  encourage  collaborations  among  participating  nodes  [11,  20,  21,  23,  24].  Wang  et 
al.  [20]  devised  an  efficient  incentive  mechanism  to  encourage  cooperative  behaviors  in 
multipath  routing.  Zhao  [23]  investigated  the  optimal  transmission  probability  and  Yan  et 
al.  [21]  developed  incentive  mechanisms  using  game  theoretic  approaches.  Miranda  et  al. 
[11]  proposed  an  algorithm  in  which  routing  behaviors  are  monitored;  selfish  nodes  are 
penalized  (their  packets  are  not  forwarded)  so  as  to  discourage  selfish  behaviors,  and 
nodes  making  heavy  demands  for  services  are  also  penalized  to  ensure  faire  allocation  of 
resources.  Different  from  the  above  work,  Zhang  et  al.  [24]  considered  the  positive  aspect 
of  having  selfish  nodes  in  terms  of  traffic  reduction,  and  established  bounds  on  the 
probability  of  a  node  being  selfish  to  optimize  system  metrics.  Our  work  in  this  paper  is 
different  in  that  we  investigate  and  identify  the  best  balance  between  individual  welfare 
via  selfish  behaviors  versus  global  interest  via  altruistic  behaviors  so  as  to  prolong  the 
system  lifetime. 

Routing  protocols  have  also  been  proposed  based  on  the  concept  of  trust  (or 
reputation)  to  isolate  selfish  nodes  [1,  12,  16]  using  incentive  mechanisms  that  discourage 
selfish  behaviors.  However,  the  trust  metric  used  often  does  not  adequately  consider 
important  properties  of  trust  in  a  MANET  environment,  including  subjectivity,  asymmetry, 
incomplete  transitivity,  dynamicity,  and  context-dependency  [5].  Our  work  takes  these 
properties  into  consideration  by  adopting  a  composite  trust  metric  that  incorporates  both 


social  trust  and  QoS  (quality-of-service)  trust.  The  QoS  and  social  components  capture 
different  aspects  of  trust  that  are  important  from  the  perspective  of  the  user  and  the  end- 
goal  of  the  mission. 

The  contributions  of  this  work  are  as  follows.  First,  we  propose  a  novel  composite 
trust  metric  encompassing  social  trust  explaining  the  aspects  of  internal,  interpersonal,  and 
mental  aspects  of  an  entity  [7]  and  QoS  trust  indicating  competence  for  task  performance. 
Second,  we  develop  and  analyze  a  trust-based  protocol  for  a  mission-driven  GCS  in 
MANETs  where  nodes  may  behave  selfishly.  We  use  DP  theory  to  quantify  the  conflicts 
between  individual  welfare  and  global  welfare  and  identify  the  conditions  that  best  prolong 
the  system  lifetime  for  successful  mission  execution  while  satisfying  performance 
requirements.  Third,  we  develop  a  mathematical  model  to  describe  the  behaviors  of  a  GCS 
based  on  hierarchical  stochastic  Petri  nets  (SPN),  allowing  optimal  conditions  to  be 
identified  to  answer  what-if  type  of  questions  in  response  to  changing  operational  and 
environmental  conditions.  Lastly,  through  numerical  data,  we  demonstrate  that  our  trust 
management  protocol  based  on  DP  theory  is  capable  of  maintaining  an  acceptable  trust 
level  for  successful  mission  execution  while  prolonging  system  lifetime,  when  compared 
with  a  traditional  all-altruistic  system. 

The  rest  of  this  paper  is  organized  as  follows.  Section  2  describes  the  system  model 
including  the  assumptions,  trust  metric,  and  energy  model.  Section  3  develops  a 
performance  model  to  describe  the  behaviors  of  a  GCS  based  on  hierarchical  stochastic 
Petri  nets.  Further,  Section  3  describes  DP  theory  being  applied  for  the  formulation  of  trust 
management.  Section  4  presents  numerical  data  obtained  from  the  evaluation  of  our 
performance  model.  In  particular,  we  compare  the  performance  of  a  GCS  operating  under 
our  proposed  trust  protocol  versus  a  solely  altruistic  GCS.  Finally,  Section  5  concludes  the 
paper  and  outlines  future  work. 


2  System  Model 

Due  to  the  unique  characteristics  of  MANETs  and  unreliable  communication  in 
wireless  networks,  trust  management  for  MANETs  should  encompass  the  following  trust 
concepts.  Trust  should  be  dynamic  to  account  for  uncertainty.  Trust  should  be  context- 
dependent,  and  subjective,  and  cannot  be  assumed  to  be  transitive  or  reciprocal.  To  address 
these  unique  trust  properties,  trust  management  for  MANETs  should  consider  the 
following  design  features:  trust  metrics  must  be  customizable,  evaluation  of  trust  should  be 
fully  distributed  without  reliance  on  a  centralized  authority,  and  trust  management  should 
cope  with  dynamics  and  adverse  behaviors  in  a  tactical  MANET  [6], 

Cognitive  networks  are  able  to  reconfigure  the  network  based  on  past  experiences  by 
adapting  to  changing  network  behaviors  to  improve  scalability  (e.g.,  reducing  complexity), 
survivability  (e.g.,  increasing  reliability),  and  QoS  (e.g.,  facilitating  cooperation  among 
nodes)  [18].  We  use  this  concept  to  indicate  a  node’s  ability  to  adapt  to  changing  network 
conditions,  such  as  a  node’s  selfish  behavior,  node  failure  or  mobility,  energy  exhaustion 
of  a  node,  or  voluntary  disconnection  for  energy  savings. 

In  the  initial  network  deployment,  we  assume  that  there  is  no  predefined  trust. 
Without  prior  interactions,  the  initial  bootstrapping  will  establish  a  shallow  level  of  trust 
based  only  on  indirect  information  (e.g.,  reputation  from  historically  collected  data  or 
recommendation  by  third  parties)  and  authentication  by  a  challenge/response  process  (e.g., 
public  key  authentication).  Over  time,  participating  nodes  will  establish  a  stronger  trust 


level  with  more  confidence  based  on  direct  or  indirect  interactions.  Our  trust  management 
protocol  allows  each  node  to  evaluate  the  trust  levels  of  other  nodes  as  well  as  to  be 
evaluated  by  other  nodes  based  on  two  factors,  social  trust  and  QoS  trust.  Social  trust 
includes  trust  properties  for  “sociable”  purposes  (e.g.,  intimacy)  while  QoS  trust  includes 
trust  properties  for  mission  execution  purposes  (e.g.,  energy  level  or  cooperation)  [5]. 

Trust  decays  over  time  without  further  updates  or  interactions  between  entities.  Node 
mobility  also  hinders  continuous  interactions  with  other  group  members,  lowering  the 
chances  of  evaluations  of  each  other  in  the  group.  This  includes  cases  such  as  a  node 
moving  to  other  areas  causing  its  disconnection  from  the  current  group,  leaving  a  group  for 
mission  reasons,  voluntary  disconnection  for  saving  power  or  involuntary  disconnection 
due  to  physical  terrain  or  low  energy.  We  use  the  concept  of  a  trust  chain  [3]  to  describe 
propagation  of  trust.  For  example,  when  A  trusts  B,  B  trusts  C,  C  trusts  D,  and  D  trusts  E, 
then,  A  may  trust  E  over  a  trust  chain  of  length  4.  However,  the  longer  the  trust  chain  is, 
the  more  is  the  decay  in  the  degree  of  trust  [3]. 

Our  target  system  is  a  mission-driven  GCS  in  tactical  military  MANETs  where  a 
symmetric  key,  called  the  group  key,  is  used  as  a  secret  key  for  group  communications 
between  group  members  [5].  Upon  a  node’s  disconnection  from  the  group,  the  system 
generates  and  redistributes  a  new  key  so  that  non-member  nodes  will  not  be  able  to  access 
a  valid  secret  group  key.  Nevertheless,  each  group  member  keeps  old  trust  information 
even  for  non-member  nodes  so  that  the  information  can  be  reused  for  future  interactions, 
possibly  preventing  a  newcomer  attack. 


2.1  Assumptions 

We  assume  that  the  GCS  is  in  a  MANET  environment  without  any  centralized  trusted 
authority.  Nodes  communicate  with  each  node  through  multiple  hops.  Nodes  have 
different  levels  of  energy,  thus  reflecting  node  heterogeneity.  Each  node  periodically 
beacons  its  id  and  location  information  so  that  node  failure  is  easily  detected  and 
accordingly  rekeying  is  done  immediately  upon  every  membership  change. 

We  assume  that  mobile  devices  are  carried  by  human  such  as  dismounted  soldiers.  A 
node  dynamically  adopts  selfish  or  altruistic  behavior  depending  on  the  remaining  energy 
level,  difficulty  level  of  the  given  mission  (i.e.,  a  tougher  mission  requires  a  higher 
workload),  and  selfishness  level  of  1-hop  neighbors.  That  is,  a  node  will  behave  selfishly 
when  it  has  low  energy,  the  mission  assigned  to  it  is  not  difficult,  and/or  there  is  a 
sufficient  number  of  cooperating  1-hop  neighbors.  We  consider  a  node  to  be  selfish  when 
the  node  drops  group  communication  packets  transmitted  by  other  nodes.  Even  though  the 
node  is  selfish,  we  assume  that  it  cooperates  to  perform  rekeying  operations  upon  a 
membership  change.  The  energy  level  of  each  node  is  adjusted  depending  on  its  status.  For 
simplicity,  we  only  consider  energy  consumption  due  to  packet  transmission  and 
reception.  Thus,  if  a  node  becomes  selfish,  the  rate  of  energy  consumption  is  slowed  down. 

We  consider  a  redemption  mechanism  by  which  a  selfish  node  can  become  a  normal 
cooperative  node  again.  Specifically,  a  selfish  node  reevaluates  its  status  at  the  end  of  each 
trust  update  interval  and  decides  whether  it  will  become  altruistic  or  stay  selfish.  This  is 
described  in  Section  3.2.  A  non-member  will  not  consume  as  much  energy  as  a  member 
because  of  less  involvement  with  group  activities.  Upon  every  membership  change  due  to 
group  join/leave,  a  rekeying  operation  will  be  performed  to  generate  a  new  group  key 
based  on  a  distributed  key  agreement  protocol  such  as  GDH  (Group  Diffie-Hellman)  [17]. 


We  assume  that  a  node’s  trust  value  is  evaluated  based  on  direct  observations  (e.g., 
packet  dropping)  as  well  as  indirect  observations.  Indirect  observations  are 
recommendations  obtained  from  1-hop  neighbors  whom  the  evaluator  trusts  the  most.  If 
enough  recommenders  cannot  be  found,  recommendations  from  all  1  -hop  neighbors  can  be 
used.  A  node’s  trust  value  may  be  updated  after  each  status  exchange  period.  A  status 
exchange  packet  includes  a  node’s  own  information  as  well  as  information  of  nodes  on  its 
trust  chain  for  possible  use  as  recommendations  on  distant  nodes  to  its  1-hop  neighbors. 

We  assume  that  existing  prevention  techniques  such  as  encryption,  authentication,  or 
rekeying  inhibit  outsider  attacks.  We  consider  the  presence  of  selfish  nodes  among 
legitimate  group  members.  We  model  the  selfish  behaviors  of  a  node  by  DP  theory  as 
described  in  Section  3.2. 


2.2  Trust  Metric 


We  consider  a  trust  metric  that  spans  two  aspects  of  the  trust  relationship  [5],  First,  we 
consider  intimacy  (or  friendliness)  for  social  trust  where  intimacy  is  measured  by  the 
degree  that  two  nodes  are  1-hop  neighbors.  Second,  QoS  trust  accounts  for  the  capability 
of  a  node  to  complete  a  given  mission.  We  consider  the  energy  level  and  degree  of 
unselfishness  (or  cooperation)  to  estimate  the  QoS  trust  level  of  a  node.  A  node’s  trust 
value  changes  dynamically  to  account  for  trust  decay  over  time  due  to  node  mobility  or 
failure,  as  the  trust  chain  becomes  longer,  as  the  node’s  energy  level  changes,  and  as  the 
node  becomes  selfish  or  cooperative. 

We  define  a  node’s  trust  level  as  a  continuous  real  number  in  the  range  of  [0,  1],  with 
1  indicating  complete  trust,  0.5  ignorance,  and  0  complete  distrust.  The  overall  trust  value 
is  calculated  based  on  three  components:  energy  level,  unselfishness,  and  intimacy.  As  will 
be  evident,  other  components  could  be  added  if  desired.  Based  on  the  trust  value  calculated 
by  1-hop  neighbors,  the  trust  value  can  be  calculated  by  n-hop  neighbors  over  a  trust 
chain. 

The  information  used  for  trust  evaluation  of  a  particular  node  j  includes  probability  of 
being  alive,  e.g.,  remaining  energy  >  threshold,  (p.energy  (t)),  probability  of  being 

unselfish  (f>unselfls  ,l(t)),  and  probability  of  being  located  in  a  particular  area  (F>,oc=fc  (t)) 
where  k  indicates  area  id.  and  t  is  time.  These  three  values  are  obtained  from  SPN  subnets 
shown  in  Fig.  2  and  the  technical  method  for  obtaining  them  from  the  SPN  subnets  is 
explained  in  Section  3.  We  use  the  term  “probability”  in  a  loose  sense;  one  should  interpret 
“probability”  here  as  “value  associated  with  a  particular  aspect”  rather  than  in  the 
frequentist  or  Bayesian  interpretation. 

Now  we  address  how  the  trust  value  is  calculated.  The  three  trust  components, 
namely,  energy  level,  unselfishness,  and  intimacy,  capture  MNAET  dynamics.  The  trust 
value  (7^.”  _,lop  (t))  0f  node  j  as  evaluated  by  node  i  where  n  indicates  the  trust  chain  length 
used  by  a  node  is  given  by: 
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The  «-hop  trust  component  X,  where  X  represents  unselfishness  or  energy,  is 
calculated  based  on  the  trust  values  obtained  from  the  trust  chain  with  lengths  1  to  n- 1  and 
is  given  by: 
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Here  /?  is  used  as  a  weight  for  the  node’s  “self-information”  and  (1-  fi)  is  a  weight  for 
“other-information.”  The  self-information  ( Pi('-n  1')  hop,x(t))  can  be  obtained  recursively 
by  using  Equation  2.  In  Equation  3,  S’,  is  the  set  of  1-hop  neighbors  of  node  i,  excluding 
node  j,  that  forward  recommendation  of  node  j  and  15;  |  =  krecom  the  number  of 
recommender  nodes  that  have  the  highest  trust  values  among  all  1-hop  neighbors  on  the 
trust  chain  of  the  evaluator.  Notice  that  when  calculating  the  trust  value  of  node  j  via  node 
k’s  recommendation,  node  i’s  trust  value  on  node  k  is  used  as  a  weight;  this  causes  trust  to 
decay  as  the  trust  chain  increases. 

Since  the  «-hop  trust  values  are  computed  based  on  the  basis  of  («-/)-hop  trust  values 
as  shown  in  Equations  2  and  3,  the  1-hop  trust  values  are  the  basis  of  all  trust  values  and 
are  computed  by: 


Pl~h0p’x(t)  (p 

pdirect  -JT(t)  +  (1  _  ^  pl-hop, indirect  -X ^ 

(4) 

pl—hop,indire  ct—X 

ZkeS,  0 Kkh°P ’  X(l  -  At>  PkJh°P’  '(t  -  Af)) 

_  If 

(5) 

^  re  com 

pl-hop, unself  is  =  0  5  pl-hop  .energy  _  Q  5 

(6) 

The  direct  information  for  the  trust  component  X  of  node  j  evaluated  by  node  i 
( pdu-ect  -x  (j) )  js  obtained,  by  dividing  node  f  s  trust  component  by  node  f  s  trust 
component,  min[PjX (t) / Ptx (t) ,  l];  it  is  thus  a  subjective  relative  evaluation.  Note  that 
Px  (t)  for  all  i  where  X  indicates  a  trust  component  obtained  from  our  SPN  model  as 
explained  in  Section  3.3.  We  assume  that  the  local  trust  component  value  of  a  node  at  time 
t  =  0  are  set  to  ignorance  (i.e.,  ignorance  value  0.5  in  the  trust  range  of  [0,  1])  during  the 
network  bootstrapping  period,  as  shown  in  Equation  6. 

In  Equation  1,  e~r  represents  a  function  of  f*"  hop  (t),  the  probability  that  nodes  i 
and  j  are  within  n  hops.  />"_,lop  (t)  is  computed  as: 
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K~hov  (0  =  2]  % Tv  (f) where  %hop  (o  =  ^  ( p!°c  =l  (o  Pjoc  =m  (o ) 

k= 1  (l.m'jeSfr 

Here  Pj0C  =m (t)  is  the  probability  that  node  j  is  in  location  m  at  time  t,  and  Sk  is  a  set 
covering  all  (/,  m)  pairs  with  the  distance  between  1  and  m  being  k  hops.  Assuming  that 
nodes  move  independently,  we  can  verify  that  P”._hop(t)  is  the  probability  that  nodes  ( i,  j) 
are  within  n  hops  of  each  other  at  time  t. 

In  e~Y ,  we  define  y  by: 


(8) 


1 

Y  =  a*  P"~hop  {t) 

where  a  is  a  positive  constant.  The  decay  factor  e~r  increases  monotonically  with 
P’lj-h°p(t),  implying  that  the  trust  evaluation  is  higher  if  it  is  more  likely  that  the  nodes  are 
closer.  The  value  of  the  constant  a  (a  <  1  versus  a  >  1)  dictates  whether  the  decay 
function  is  convex  or  concave  increasing  in  P’lj~hop(t).  The  value  of  the  constant  a  affects 
the  propagation  of  trust;  guidelines  for  choosing  this  parameter  will  be  discussed 
elsewhere.  Note  that  we  use  Equations  2-6  to  compute  trust  component  values  of 
unselfishness  and  energy. 

pmtimacy  ^  ,  t|le  qqrd  component  of  Equation  1,  can  be  obtained  without  the  help  of 
other  nodes’  recommendations  since  each  node  can  detect  and  keep  track  of  information 
on  who  has  been  with  them  as  1  -hop  neighbors  through  the  beacon  messages  disseminated 
by  each  node  periodically.  p™tlmacy  (t),  the  degree  that  nodes  i  and  j  are  1-hop  neighbors, 
is  computed  by: 


p  intimacy 
i>j 


(t)  =  P^h0V(t)/Pi 


max  —intimacy 


(0 


(9) 


where  P™x  ~intimacy  (t)  =  max  [P^hop . P^hop  ]  (10) 

In  Equation  9,  the  normalization  by  P-nax  ~lntlmacy  (t)  provides  relative  weights  to 
intimacy,  now  ranging  from  0  to  1.  Note  that  p™tlmacy  (o)  can  be  calculated  based  on  the 
location  information  preloaded  in  the  initial  network  deployment. 

We  also  derive  the  objective  trust  values  of  each  node  in  order  to  compare  it  against 
the  trust  value  calculated  by  each  node,  called  subjective  trust.  The  objective  trust  is 
calculated  without  considering  any  network  dynamics  such  as  node  mobility,  trust  decay 
over  time,  and  trust  decay  as  the  trust  chain  becomes  longer.  The  objective  trust  of  node  i 
is  calculated  by: 


rpob j  _  | ' punself  is  h  pintimacy 


(o + prr9y  3 


in) 


^intimacy 


&jesP-~h°P(t)/N) 
pavg  —obj  —intimacy 


Elere  p"nse,f‘ ,s  h  (f)  ?  pmtimacy  an(j  penergy  ^  three  components  of  trust 

derived  from  the  SPN  subnets  explained  in  Section  3.  Ideally,  the  objective  trust  value 
T°bJ  (0,  of  node  j,  would  be  known  to  all  other  nodes.  In  practice,  node  i  estimates  the 
trust  value  via  the  subjective  trust  value  7j"  hop  (t)  as  discussed  earlier  in  Equation  1.  As 
discussed  by  Josang  et  al.  [8],  it  is  desirable  that  the  subjective  trust  value  is  below  the 
objective  trust  value;  this  ensures  that  agents  are  not  exposed  to  unnecessary  risk,  but 
clearly  there  will  be  missed  reward.  We  will  consider  objective  intimacy  based  on  the 
average  intimacy  degree  on  node  i  evaluated  by  all  other  nodes  divided  by  the  average 
intimacy  probability  (i.e.,  the  average  probability  that  two  nodes  will  be  located  as  1-hop 
neighbors  in  the  operational  area).  See  Section  3  for  a  specific  numeric  example.  We  can 
then  evaluate  how  accurately  subjective  trust  values  are  calculated  by  varying  the  length  of 
the  trust  chain  through  Equation  1,  and  comparing  them  with  the  objective  trust  shown  in 


Equation  11.  Note  that  the  objective  trust  is  not  known  in  real  situations,  and  so  it  is 
predicted  and  used  to  conservatively  evaluate  the  validity  of  the  proposed  scheme. 

In  Equation  1,  we  derive  a  in  order  for  a  trust-based  system  lifetime  based  on  subjective 
trust  to  be  at  least  equal  to  or  less  than  one  based  on  objective  trust.  Here  by  the  system 
lifetime,  we  mean  the  the  accumulated  ime  period  over  which  the  system  trust  values  are 
above  a  certain  system  drop  dead  trust  level,  say  Tvalue  ,  as  used  in  Section  4. 


2.3  Energy  Model 

We  associate  the  energy  level  of  a  node  with  its  state:  selfish  or  group  member. 
Depending  on  its  remaining  energy,  a  node  acts  differently.  The  degree  of  energy 
consumption  is  also  affected  by  the  node’s  state.  Thus,  these  parameters  are  interwoven 
and  affect  a  node’s  lifetime  significantly. 

A  GCS  in  MANETs  must  handle  events  such  as  beaconing,  group  communication, 
rekeying,  and  status  exchange.  In  particular,  after  a  status  exchange  event,  trust  evaluation 
of  1-hop  neighboring  nodes  as  well  as  of  distant  nodes  is  performed.  Each  node  may 
transmit  its  own  status  (e.g.,  information  providing  the  trust  values)  as  well  as  status  of 
other  nodes  (i.e.,  trust  values)  on  its  trust  chain.  Recall  that  we  use  recommendations  from 
1-hop  neighbors  for  trust  evaluation  and  each  status  message  is  disseminated  periodically. 
Due  to  space  constraints,  we  omit  the  detail  of  the  energy  consumption  model  and  refer  the 
reader  to  [5]. 


3  Performance  Model 


This  section  describes  how  our  analytical  model  is  developed  using  SPN  and  how 
trust  values  are  obtained  from  the  SPN  models. 


3.1  Hierarchical  Modeling  using  SPNs 


Run  for  each  node 


SPN  subnet:  each  node’s 
infonnation  on  the  3  components 
of  the  trust  metric  is  collected 
upon  every  trust  update  interval 


NO 


Trust  value  is  computed 

from  the  last  round  of  iterations 
that  has  met  convergence 
conditions  upon  every  trust 


update  interval 


*  * 


YES 


MPD  <  threshold 


Fig.  1.  Hierarchical  modeling  using  SPN  subnets. 


We  develop  a  mathematical  model  based  on  SPN  to  analyze  a  GCS  with  nodes 
switching  between  selfish  and  altruistic  behaviors  based  on  the  theory  and  identify  design 
conditions  under  which  the  selfish  versus  altruistic  behaviors  can  be  balanced.  With 
system  lifetime  and  mission  success  probability  as  our  reliability  metric,  we  show  that  our 
trust  management  protocol  operating  under  identified  design  conditions  outperforms  one 
that  only  encourages  altruistic  behaviors.  We  use  SPN  due  to  its  efficient  representation  of 
a  large  number  of  states  where  the  underlying  models  are  Markov  or  semi-Markov  models. 
We  develop  a  hierarchical  modeling  technique  to  avoid  state  explosion  problems  and  to 
improve  solution  efficiency  for  realizing  and  describing  a  large  scale  GCS. 

We  use  an  SPN  subnet  to  describe  each  node’s  lifetime.  The  square-shaped 
operational  area  consists  of  mxm  sub-grid  areas  with  the  width  and  height  equal  to  wireless 
radio  range  ( R ).  Initially  the  location  of  each  node  is  randomly  distributed  over  the 
operational  area  based  on  the  uniform  distribution.  A  node  randomly  moves  to  one  of  four 
locations  in  four  directions  (i.e.,  north,  west,  south,  and  east)  in  accordance  with  its  speed. 
The  speed  of  each  node  Sinit  is  chosen  uniformly  over  [0,  vmax)  m/s  where  vmax  is  the 
maximum  possible  speed,  and  Sinit  is  then  fixed  during  the  node’s  lifetime.  The  boundary 
grid  areas  are  wrapped  around  (i.e.,  a  torus  is  assumed)  to  avoid  end-effects.  The  SPN 
subnet  for  node  i  computes  the  probability  that  node  i  is  in  a  particular  grid  area  j  at  time  t. 
This  information  along  with  the  information  of  other  nodes’  location  at  time  t  provides  the 
information  about  a  node’s  «-hop  neighbors  at  time  t,  which  we  will  use  to  compute  the 
trust  metric  (see  Section  2.2).  Since  node  movements  are  assumed  to  be  independent,  the 
probability  that  two  nodes  are  in  a  particular  location  at  time  t,  is  given  by  the  product  of 
the  two  individual  probabilities.  The  SPN  subnet  also  describes  a  node’s  lifetime  and  can 
be  used  to  obtain  each  node’s  information  (amount  of  energy,  unselfishness,  and  intimacy) 
to  derive  the  trust  relationship  with  other  nodes  in  the  system.  This  process  is  done  by 
running  the  SPN  subnet  N  times  for  the  N  nodes  in  the  network. 

In  the  first  round  of  iteration,  since  there  is  no  information  available  about  1-hop 
neighbors,  it  is  assumed  that  each  area  has  an  equal  number  of  nodes  and  all  nodes  are 
unselfish.  In  the  second  round  of  iteration,  based  on  the  information  collected  (e.g., 
number  of  unselfish  or  selfish  1-hop  neighbors)  from  the  first  round,  each  node  knows 
how  many  nodes  are  1  -hop  neighbors  that  can  directly  communicate  with  it,  and  whether 
or  not  they  are  members  of  the  GCS  or  selfish.  A  node  also  knows  how  many  «-hop 
neighbors  it  has  at  time  t.  It  then  adjusts  its  perceived  status  of  1-hop  neighbors  at  time  t 
with  the  output  generated  from  the  /h  round  of  iteration  as  input  to  the  (j+l)th  round  of 
iteration.  This  process  continues  until  a  specified  convergence  condition  is  met.  The  Mean 
Percentage  Difference  (MPD)  is  used  to  measure  the  difference  between  critical  design 
parameter  values,  including  a  node’s  energy  level,  the  selfish  probability,  and  the  unselfish 
probability  of  a  node  at  time  t  in  two  consecutive  iterations.  The  iteration  stops  when  the 
MPD  is  below  a  threshold  1  percent  (%)  for  all  nodes  in  the  system.  The  calculation  of  the 
MPD  of  parameter  X  for  node  i  is  given  by: 


MPD f  = 


Y?ax  Djit) 

^ interval 


where  Df  (t)  = 


\xj+1  (0-x/(t)  | 

A/(t) 


(13) 


where  Xj  (t)  indicates  the  value  of  parameter  X  of  node  i  at  time  t  in  the  /h  round  of 
iterations,  max  is  the  maximum  time  measured,  and  Nintervai  the  number  of  time  points. 
We  compute  MPD  for  each  node’s  probabilities  of  being  alive,  selfish,  and  unselfish.  The 
node  SPN  subnet  after  convergence  yields  the  trust  probabilities  for  three  trust  components 


(i.e.,  unselfishness,  energy,  and  intimacy).  The  trust  metric  is  then  calculated  as  explained 
in  Section  2.2. 


T  ENERGY  T  JOIN  T  LEAVE  T  LOCATION  T_SELFISH  T  REDEMP 


Fig.  2.  SPN  subnet  for  describing  the  status  of  a  node. 

Fig.  2  shows  the  SPN  subnet.  The  subnet  describes  a  node’s  mobility  behavior,  join 
and  leave  events  (i.e.,  GCS  membership  status),  energy  consumption,  and  selfish  behaviors 
with  a  redemption  mechanism  provided.  The  transition  T  LOCATION  is  triggered  when  a 
node  moves  to  a  randomly  selected  area  in  one  of  four  different  directions  from  its  current 
location  with  the  rate  calculated  as  Sinit  / R  based  on  an  initial  speed  (Sini,)  and  wireless 
radio  range  ( R ).  We  assume  that  inter-arrival  times  of  a  node’s  join  and  leave  requests  are 
exponentially  distributed  with  rates  1  and  u  respectively.  Place  energy  represents  the 
current  energy  level  of  a  node. 

An  initial  energy  level  is  assigned  according  to  node  heterogeneity  information.  In  our 
analytical  model,  we  randomly  generate  a  number  Einit  in  the  range  of  [ Emin,Emax ] 
based  on  the  uniform  distribution.  A  token  is  taken  out  when  transition  TENERGY  fires. 
The  transition  rate  of  T  ENERGY  is  adjusted  on  the  fly  based  on  a  node’s  state;  it  is  lower 
when  a  node  becomes  selfish  to  save  energy  or  when  a  node  changes  from  a  member  to  a 
non-member,  following  the  energy  consumption  model  in  [5],  We  assume  that  T  seconds 
will  be  taken  to  consume  one  energy  token  when  a  member  node  has  no  selfish  1-hop 
neighbors.  We  use  this  energy  consumption  model  for  adjusting  the  time  taken  to  consume 
one  token  in  place  energy’  based  on  a  node’s  status.  Therefore,  depending  on  the  node’s 
status,  its  energy  consumption  behavior  is  dynamically  changed. 

Place  SN  represents  whether  a  node  is  selfish  or  not.  If  a  node  becomes  selfish,  a 
token  goes  to  SN  by  triggering  T  SELFISH.  When  a  node  becomes  altruistic  again, 
transition  T  REDEMP  is  triggered.  A  node  switches  between  selfish  and  altruistic 
following  the  demand  and  pricing  theory  described  in  Section  3.2  below.  The  SPN  model 
in  Fig.  2  yields  the  trust  components  Pj(t)  where  X  =  energy,  unselfishness,  and  location 
(to  derive  intimacy),  from  which  the  «-hop  trust  components  and  the  trust  metric  can  be 
computed  via  Equations  1-10. 


3.2  Demand  and  Pricing  Model 

The  basic  formula  to  represent  the  relationship  between  demand  and  pricing  in  a 
market  is  given  by  [4,  2]: 

(14) 

Xt  =  a,(v ;)  £‘  where  £,  >  l,at  >  0 

where  Xt  is  the  demand  arrival  rate  and  vt  is  the  pricing  of  service  i  while  a,  and  £t  are 
constants  correlating  Xt  and  vt.  Service  demand  is  affected  by  pricing  changes  where 
the  elasticity  constant  £)  is  a  key  determinant.  A  market  is  said  to  be  elastic  if  st  >  1,  as 
assumed  here.  In  such  a  case  lowering  the  price  leads  to  increase  in  demand.  The  elasticity 
£j  can  be  obtained  from  statistical  data  describing  past  market  conditions. 


We  adopt  DP  theory  to  decide  whether  a  node  should  behave  selfishly  or  altruistically 
based  on  both  individual  benefit  (i.e.,  saving  energy)  and  global  interest  (i.e.,  serving 
tasks).  We  use  transition  TSELFISH  in  our  SPN  model  (described  in  Section  3)  to  model 
a  node’s  changing  behavior  from  altruistic  to  selfish.  Note  that  remaining  energy  of  a 
node,  mission  difficulty,  and  degree  of  unselfishness  of  1-hop  neighbors  are  used  for  the 
place  of  “price”  to  apply  DP  theory  in  Equation  14.  The  transition  rate  to  transition 
T  SELFISH  is  modeled  by: 

rate  (T_S ELFISH)  =  f{Eremain  ^difficulty  MW  ) 

Tgc 

where  f(x)  —  ax~E  ,  Eremain  is  the  level  of  current  energy  (indicated  as 
mark(energy)  in  SPN  model  of  Section  3),  Mdifficulty  is  the  difficulty  level  of  a  given 
mission  where  a  higher  value  indicates  a  tougher  mission,  and  Sdegree  is  the  degree  of 
selfishness  where  a  higher  number  refers  to  more  selfishness.  We  define  Sdegree  as  the 
ratio  of  selfish  nodes  to  unselfish  nodes  among  1-hop  neighbors  (refer  to  [5]  for  the 
calculation  of  the  number  of  selfish/unselfish  1-hop  neighboring  nodes).  Tgc  is  the 
interval  for  disseminating  a  group  communication  packet  where  a  node’s  selfishness  can 
be  observed.  In  the  context  of  DP  theory,  residual  energy,  mission  difficulty  and 
neighborhood  selfishness  are  the  prices,  and  the  transition  rate  from  altruistic  to  selfish  is 
the  demand.  Equation  15  implies  the  following: 

•  f  (Eremain  ):  If  a  node  has  a  higher  level  of  energy,  it  is  less  likely  to  be  selfish. 

•  /  {^difficulty  ):  If  a  node  is  assigned  a  tougher  mission,  it  is  less  likely  to  be  selfish. 

•  /(S degree  ):  If  a  node  observes  high  selfishness  among  its  1-hop  neighbors,  it  is  less 
likely  to  be  selfish. 

Similarly,  we  use  a  transition  TREDEMP  in  the  SPN  model  (shown  in  Fig.  2  of 
Section  3.1)  to  model  the  redemption  of  a  node,  changing  its  behavior  from  selfish  to 
altruistic.  The  rate  to  transition  T  REDEMP  is  modeled  as: 


.  m  n  rr.  1-n.j  n\  /(^ consumed  )/ (^easiness')  f  (^degree  ) 

rate(T_REDEMP)  = - — - 

*  status 

where/  (x)  —  ax  ~£,  Econsumed  is  the  level  of  consumed  energy  (Einit  —  Eremain  )  where 
Eremain  refers  to  the  remaining  energy,  Measiness  is  the  easiness  level  of  a  given  mission 
where  a  higher  number  indicates  an  easier  mission  (e.g.,  Mmax  -difficuity  —  Mdirriculty  ), 
and  Hdegree  is  the  degree  of  unselfishness  where  a  higher  number  means  more 
unselfishness  among  1-hop  neighbors.  We  define  Hdegree  =  1/Sdegree  as  the  ratio  of 
unselfishness  to  selfishness  (refer  to  [5]  for  the  calculation  of  the  number  of 
selfish/unselfish  1-hop  neighboring  nodes).  A  node  is  given  a  chance  to  be  redeemed  (from 
selfish  to  altruistic)  in  every  reevaluation  period  Tstatus  corresponding  to  the  status 
exchange  interval  for  trust  evaluation.  Equation  16  implies  the  following: 

•  f  (Econsumed  ):  ID  node  has  consumed  more  energy,  it  is  less  likely  to  redeem  itself. 
This  means  that  if  a  node  has  low  energy,  it  may  want  to  further  save  its  energy  by 
staying  selfish. 

•  /(M easiness  /  If  a  node  is  assigned  an  easier  mission,  it  is  less  likely  to  redeem  itself. 


•  f(H degree  ):  If  a  node  observes  high  unselfishness  among  its  1-hop  neighbors,  it 
is  less  likely  to  redeem  itself  and  may  continue  to  stay  selfish  in  order  to  save  its 
energy. 

3.3  Calculation  of  Trust  Components 

The  trust  value  of  node  j  by  node  i  is  calculated  based  on  the  information  on  nodes 
collected  from  the  SPN  subnet  upon  convergence.  We  calculate  the  trust  probabilities  for 
the  three  components  (i.e.,  Pj  (t))  of  trust  based  on  a  reward  assignment  technique 
described  below.  Specifically,  the  average  value,  W  (t),  of  a  physical  property  at  time  t,  is 
the  state  probability  weighted  sum  of  the  values  at  various  states,  i.e., 

no  =  JV,  *p,(0)  (17) 

ies 

where  S  is  a  set  of  states  that  meet  particular  conditions,  Pt  (t)  is  the  probability  that  the 
system  is  in  state  i  at  time  t,  and  r;  is  the  reward  or  value  assigned  to  the  physical 
property  in  state  i.  The  reward  assignment  technique  allows  us  to  compute  a  node’s  trust 
component  values,  say  Pj  where  X  can  be  unselfishness  and  energy,  and  location 
information  Fy,oc=m  to  derive  intimacy  trust  component  values  at  time  t.  We  use  the  same 
reward  assignment  technique  to  obtain  Ppunseifis  /i  (0  and  ^,sei/ish(0>  the  probability 
that  node  i  is  located  in  area  k  as  being  selfish  or  unselfish. 

Table  1.  Reward  functions. 


Component 

Conditions  Satisfied  in  S 

penergy 

mar  keener  gy)  >  0 

punsel  fish 

( mark{member )  >  0)  &  ( mark(SN )  ==  0)  &  (mar keener gy)  >  0) 

ploc=k(t) 

(mar k(lo cation)  ==  fc)  &  ( mark(member )  >  0)&  (mark(energy)  >  0) 

ploc=k  (ps 

K  unself  ish^J 

(• mark(member )  >  0)  &  ( mark(SN )  ==  0)  &  (mark(energy)  > 

0  &  ( marklocation==k) 

PlsemshW) 

(i mark(member )  >  0)  &  (mark(SN)  >  0)  &  (mark(ener gy)  >  0) 

&  (mar k(lo cation)  ==  k) 

Table  1  specifies  the  conditions  to  be  satisfied  for  states  in  set  S  in  calculating 
penergy(t)i  punsetfis  h pioc  =k (t) ,  and  (t) .  When  the  specified 

conditions  are  satisfied,  a  reward  of  a  1  is  assigned.  Based  on  =fc  (t)  so  obtained, 
various  k-hop  trust  probabilities  can  be  computed.  For  example,  the  trust  value  for  the 
intimacy  component  when  i  and  j  are  1-hop  apart,  p.'’nimacy  ;  can  aiso  be  obtained  as 
described  in  Section  2.2. 


4  Numerical  Results  and  Analysis 

This  section  shows  the  results  obtained  through  the  evaluation  of  our  hierarchical  SPN 
model.  Table  2  summarizes  the  parameters  and  their  default  values  used  in  this  case  study. 


Table  2.  Default  parameter  values  used. 


Param 

Value 

Param 

Value 

Param 

Value 

k 

rvrecom 

R 

X 

M 

P 

3 

250  m 
1/(60*60) 
1/(60*60*4) 

0.8:  0.2 

N 

T 

x  status 

T 

1  beacon 

T 

c.  • 

°imt 

150 

60*10  s 

60*2  s 

60*60  s 
(0,  2)  m/s 

a,  s 

F.  . 
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As  shown  in  Table  2,  we  set  the  elasticity  constant  e  to  2.  To  maintain  a  sufficient 
number  of  active  nodes  in  the  network,  the  ratio  of  node  join  and  leave  is  set  to  4:1.  The 
energy  level  assigned  to  each  node  has  an  average  value  of  9  hours,  representing  a 
reasonable  average  battery  life  for  mobile  devices. 
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Fig.  3.  System  trust  value  versus  time,  for  various  trust  chain  lengths. 


Fig.  3  shows  the  average  trust  values  of  all  nodes  evaluated  by  all  nodes  (hereafter 
called  “system  trust”)  over  time  parameterized  by  the  length  of  the  trust  chain  (labeled  as 
TC)  under  Ml.  We  notice  that  the  maximum  trust  values  are  obtained  with  TC  =  3.  The 
effect  of  using  different  lengths  of  TC  on  trust  levels  is  already  examined  in  our  prior  work 
[5].  Note  that  objective  trust  predicted  via  Equation  11  is  always  larger  than  the  subjective 
trust  computed  via  Equations  1-10.  Thus  units  are  not  exposed  to  unnecessary  risk  (as 
noted  by  Josang  et  al.  [8]);  but  this  also  implies  that  there  is  some  missed  reward. 
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Fig.  4.  System  trust  value  over  time  under  DP  and  ALT,  and  for  various  missions  with  TC  =  3. 

Fig.  4  depicts  the  maximum  system  trust  values  identified  by  TC  =  3.  We  compare  the 
demand  and  pricing  based  system  (labeled  as  DP)  with  the  solely  altruistic  system  (labeled 
as  ALT)  when  different  missions  are  given  (labeled  as  Ml,  M2,  and  M3,  where  M3 
reqtiires  the  highest  workload  in  this  case  study).  As  expected,  the  system  assigned  M3  has 
the  lowest  trust  values  while  the  system  assigned  Ml  performs  the  best,  showing  the 
highest  trust  values.  Further,  DP  significantly  performs  better  than  ALT  for  the  same 
mission  Ml  or  M2  and  its  effect  is  more  pronounced  as  time  progresses.  Our  composite 
trust  metric  takes  into  account  both  the  energy  level  as  well  as  the  degree  of  unselfishness 
(or  cooperation).  As  a  result,  the  use  of  DP  yields  higher  trust  values.  Under  M3,  the 
mission  difficulty  is  increased;  hence,  nodes  do  not  behave  selfishly  in  the  beginning. 
Thus,  we  note  that  DP  performs  only  slightly  better  than  ALT  in  the  beginning.  Because  of 
the  increased  workload,  energy  consumption  is  larger,  and  the  system  lifetime  is 
correspondingly  shorter  under  M3  when  compared  with  Ml  and  M2. 


Table  3.  Percentage  of  cooperative  nodes  versus  system  lifetime  when  Tvalue  >  0.5. 


(Ml,  DP) 

(Ml,  ALT) 

(M2,  DP) 

(M2,  ALT) 

(M3,  DP) 

(M3,  ALT) 

%  of  cooperative  nodes 
when  Tvai„e  >  0.5 

>  27% 

>  65% 

>  35% 

>  54% 

>  25% 

>  78% 

Lifetime  when  TVai„e  >  0.5 

26400  s 

17400  s 

14400  s 

9600  s 

3200  s 

1800  s 

Selfish  behaviors  can  increase  system  lifetime  by  saving  energy;  on  the  other  hand,  if 
too  many  nodes  are  selfish,  there  will  be  not  an  adequate  number  of  cooperative  nodes, 
and  the  mission  will  fail.  Next  we  examine  the  maximum  degree  of  selfishness  that  can  be 
allowed  in  order  to  improve  successful  mission  completion.  Suppose  the  mission  can  be 
executed  successfully  as  long  as  there  is  at  least  one  cooperative  node  in  an  area  and  a 
node  maintains  its  trust  level  at  least  above  the  ignorance  level,  0.5.  Table  3  shows  the 
percentage  of  cooperative  nodes  when  the  system  drop  dead  trust  value  (Tvaiue)  is  at  least 


above  0.5  under  DP  and  ALT  for  various  types  of  missions.  Table  3  also  shows  the  system 
lifetime,  the  total  time  when  Tvalue  is  above  0.5.  ALT  has  a  larger  number  of  cooperative 
nodes;  but  unlike  DP,  it  does  not  take  into  account  energy,  and  thus  it  is  unable  to  maintain 
a  high  trust  level.  We  also  see  that  as  the  mission  difficulty  decreases,  the  system  is  able  to 
prolong  its  lifetime  under  DP,  maintaining  at  least  the  minimum  required  number  of 
cooperative  nodes. 


5  Conclusions 

In  this  paper,  we  developed  and  analyzed  a  trust  management  protocol  for  a  mission- 
driven  GCS  in  MANETs;  we  used  demand  and  pricing  theory  to  model  selfish  and 
altruistic  behaviors  to  balance  individual  welfare  (i.e.,  saving  energy)  versus  global 
welfare  (i.e.,  serving  tasks  and  completing  the  mission).  Our  trust  management  protocol 
based  on  DP  theory  allows  each  node  to  dynamically  decide  if  it  should  stay  selfish  or 
altruistic  in  response  to  changing  environmental  conditions  so  that  the  overall  system  trust 
level  can  be  maximized.  We  developed  a  probability  model  based  on  SPN  to  describe  the 
behavior  of  a  large  scale  GCS  operating  under  the  proposed  trust  management  protocol. 
The  results  show  that  our  trust  management  protocol  outperforms  one  that  only  encourages 
altruistic  behaviors,  especially  when  the  mission  assigned  to  the  GCS  demands  light  to 
medium  workloads;  under  these  cases  our  protocol  can  best  explore  the  tradeoff  between 
energy  saved  due  to  selfishness  versus  quick  energy  drainage  due  to  altruism. 

As  future  work,  we  plan  to  (1)  examine  the  sensitivity  of  the  results  obtained  with 
respect  to  a  and  e  which  are  two  important  parameters  in  the  demand  and  pricing  theory 
underlying  our  trust  management  protocol;  (2)  develop  a  more  sophisticated  mission 
model  considering  the  effect  of  mission  attributes  such  as  risk,  deadline,  and  workload 
requirements;  (3)  analyze  the  impact  of  imperfect  detection  of  node  failures  and  attacks; 
and  (4)  consider  group-based  mobility  models. 
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